Fandom

Malware Wiki

1stVir

1,327pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.1stVir is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.1stVir.3032
  • Virus.DOS.1stVir.3173

BehaviorEdit

When the virus is run, it hooks 1Ch, 21h, and 28h to infect any executable that is run by writing itself to the end of the file. The infection size varies in different files.

When the file is executed, the virus stores its name, and infects that file on INT 1Ch or INT 28h calls. So the virus infects the file not at the same moment when the file is executed, but with some delay.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
1stVir.3032 4,096
1stVir.3173 4,096

PayloadEdit

The virus hooks INT 9 and 13h for activation. When activated the virus changes the video mode, pages, cursor and mouse position, and displays the string "1st".

Other detailsEdit

The virus contains the encrypted text strings:

EXECOM
1stVIR

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.